PT-2021-24114 · Nxp · Nxp Kinetis K82

Published 2021-12-01 · Updated 2021-12-16 · CVE-2021-44479

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AC:L/AV:L/A:L/C:H/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: NXP Kinetis K82 devices (affected versions not specified)

Description: The issue is related to a buffer over-read that occurs when a crafted wlength value is used in a GET Status-Other request during USB In-System Programming (ISP) mode. This results in the disclosure of protected flash memory.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-44479

Affected Products

Nxp Kinetis K82

References · 5

• 🔥❌ https://github.com/Xen1thLabs-AE/CVE-2021-40154 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-44479 · Security Note
• https://darkmatter.ae/xen1thlabs/published-advisories · Note
• https://t.me/cibsecurity/33205 · Telegram Post
• https://t.me/cvenotify/24235 · Telegram Post